Format expires with second precision per TUF spec

[arpitjain099]

What this does

Fixes the expires serialization so it conforms to the TUF spec date/time format.

The four role MarshalJSON methods in metadata/marshal.go (RootType, SnapshotType, TimestampType, TargetsType) wrote the expires field as a raw time.Time:

dict["expires"] = signed.Expires

encoding/json serializes a time.Time with RFC3339Nano, so any sub-second component leaks into the output, for example 2030-01-01T00:00:00.99008Z. The TUF spec requires a whole-second UTC timestamp of the form YYYY-MM-DDTHH:MM:SSZ.

Changes

• Add a small formatExpires helper plus an expiresFormat layout constant in metadata/marshal.go, and use the helper at all four marshal sites so they agree on a single format.
• Unmarshal is left untouched. It still accepts and round-trips sub-second input (parsing simply truncates to whole seconds on the next marshal).
• Add metadata/expires_format_test.go:
  • TestExpiresMarshalSecondPrecision marshals each of the four role types built from a time.Time that carries sub-second precision and asserts the emitted expires matches ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$.
  • TestExpiresMarshalUnmarshalRoundTrip marshals, unmarshals, and confirms the value round-trips and re-marshals stably.
• Update the existing marshal-output golden assertions in metadata/metadata_test.go that hard-coded the old sub-second output (...45.0000001Z) to the corrected ...45Z. The sub-second testRootBytes literal is kept as parse-direction input so the suite still exercises sub-second tolerance on unmarshal.
• Regenerate the on-disk signed fixtures (root.json, snapshot.json, targets.json, timestamp.json under internal/testutils/repository_data/repository/metadata) so their rsassa-pss-sha256 signatures match the corrected second-precision signed body. Each fixture changes only two values: the expires string and the corresponding signature. The fixtures were re-signed with their existing keystore keys using the repo's own internal/testutils/rsapss.LoadRSAPSSSignerFromPEMFile helper, so the scheme is unchanged.

The legacy parse-only fixture 1.root.json is intentionally left as-is: it is consumed by TestFromFile/TestFromBytes to assert sub-second parse tolerance, is never re-serialized or signature-verified in tests, and is signed by a key whose private half is not in the keystore.

Testing

go test ./metadata/...
gofmt -l metadata/marshal.go metadata/metadata_test.go metadata/expires_format_test.go   # no output
go vet ./metadata/...                                                                      # clean

go vet and gofmt are clean. The new tests fail on the unpatched code (all four roles emit sub-second precision) and pass after the fix. TestCompareFromBytesFromFileToBytes, TestToFromBytes, TestKeyVerifyFailures, and TestMetadataVerifyDelegate continue to pass with the regenerated fixtures.

Fixes #596

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR updates TUF metadata JSON serialization to emit the expires timestamp in spec-required whole-second UTC format (no fractional seconds) and aligns tests/fixtures accordingly.

Changes:

• Added centralized expires formatting helper and applied it to all role MarshalJSON implementations.
• Updated existing unit tests to expect second-precision expires strings.
• Added dedicated tests + updated repository JSON fixtures/signatures to reflect the new canonical expires formatting.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

File	Description
metadata/marshal.go	Formats expires as whole-second UTC during JSON marshaling for all role types.
metadata/metadata_test.go	Updates expected serialized JSON in multiple tests to match second-precision expires.
metadata/expires_format_test.go	Adds focused unit tests to enforce/verify second-precision UTC expires formatting and round-trip behavior.
internal/testutils/repository_data/repository/metadata/*.json	Updates test repository metadata fixtures (including signatures) to reflect new expires canonicalization.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.